diff --git a/daemons/ganeti-confd b/daemons/ganeti-confd
index d19bfad0618d79187b0699faf3e8947b44a58b99..82734ef1f0b6b9e4b6417123f03ed3cda7c05668 100755
--- a/daemons/ganeti-confd
+++ b/daemons/ganeti-confd
@@ -335,8 +335,8 @@ def CheckConfd(_, args):
 
   # TODO: collapse HMAC daemons handling in daemons GenericMain, when we'll
   # have more than one.
-  if not os.path.isfile(constants.HMAC_CLUSTER_KEY):
-    print >> sys.stderr, "Need HMAC key %s to run" % constants.HMAC_CLUSTER_KEY
+  if not os.path.isfile(constants.CONFD_HMAC_KEY):
+    print >> sys.stderr, "Need HMAC key %s to run" % constants.CONFD_HMAC_KEY
     sys.exit(constants.EXIT_FAILURE)
 
 
diff --git a/lib/backend.py b/lib/backend.py
index e16a321c82b068fc82494edbc4e0c0eb861d9a35..601a3f3627debdecb8f7ad903485b9d4cc674b3b 100644
--- a/lib/backend.py
+++ b/lib/backend.py
@@ -183,7 +183,7 @@ def _BuildUploadFileList():
     constants.VNC_PASSWORD_FILE,
     constants.RAPI_CERT_FILE,
     constants.RAPI_USERS_FILE,
-    constants.HMAC_CLUSTER_KEY,
+    constants.CONFD_HMAC_KEY,
     ])
 
   for hv_name in constants.HYPER_TYPES:
@@ -399,7 +399,7 @@ def LeaveCluster(modify_ssh_setup):
       logging.exception("Error while processing ssh files")
 
   try:
-    utils.RemoveFile(constants.HMAC_CLUSTER_KEY)
+    utils.RemoveFile(constants.CONFD_HMAC_KEY)
     utils.RemoveFile(constants.RAPI_CERT_FILE)
     utils.RemoveFile(constants.NODED_CERT_FILE)
   except: # pylint: disable-msg=W0702
diff --git a/lib/bootstrap.py b/lib/bootstrap.py
index 3647ad84205edb45509724d0971d1f9db9d611c3..9f997c07e27c2e32c2d8fb90ae23071757f532e7 100644
--- a/lib/bootstrap.py
+++ b/lib/bootstrap.py
@@ -111,7 +111,7 @@ def GenerateHmacKey(file_name):
                   backup=True)
 
 
-def GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, new_hmac_key,
+def GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, new_confd_hmac_key,
                           rapi_cert_pem=None):
   """Updates the cluster certificates, keys and secrets.
 
@@ -119,8 +119,8 @@ def GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, new_hmac_key,
   @param new_cluster_cert: Whether to generate a new cluster certificate
   @type new_rapi_cert: bool
   @param new_rapi_cert: Whether to generate a new RAPI certificate
-  @type new_hmac_key: bool
-  @param new_hmac_key: Whether to generate a new HMAC key
+  @type new_confd_hmac_key: bool
+  @param new_confd_hmac_key: Whether to generate a new HMAC key
   @type rapi_cert_pem: string
   @param rapi_cert_pem: New RAPI certificate in PEM format
 
@@ -135,10 +135,10 @@ def GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, new_hmac_key,
                   constants.NODED_CERT_FILE)
     GenerateSelfSignedSslCert(constants.NODED_CERT_FILE)
 
-  # HMAC key
-  if new_hmac_key or not os.path.exists(constants.HMAC_CLUSTER_KEY):
-    logging.debug("Writing new HMAC key to %s", constants.HMAC_CLUSTER_KEY)
-    GenerateHmacKey(constants.HMAC_CLUSTER_KEY)
+  # confd HMAC key
+  if new_confd_hmac_key or not os.path.exists(constants.CONFD_HMAC_KEY):
+    logging.debug("Writing new confd HMAC key to %s", constants.CONFD_HMAC_KEY)
+    GenerateHmacKey(constants.CONFD_HMAC_KEY)
 
   # RAPI
   rapi_cert_exists = os.path.exists(constants.RAPI_CERT_FILE)
@@ -428,14 +428,14 @@ def SetupNodeDaemon(cluster_name, node, ssh_key_check):
 
   noded_cert = utils.ReadFile(constants.NODED_CERT_FILE)
   rapi_cert = utils.ReadFile(constants.RAPI_CERT_FILE)
-  hmac_key = utils.ReadFile(constants.HMAC_CLUSTER_KEY)
+  confd_hmac_key = utils.ReadFile(constants.CONFD_HMAC_KEY)
 
   # in the base64 pem encoding, neither '!' nor '.' are valid chars,
   # so we use this to detect an invalid certificate; as long as the
   # cert doesn't contain this, the here-document will be correctly
   # parsed by the shell sequence below. HMAC keys are hexadecimal strings,
   # so the same restrictions apply.
-  for content in (noded_cert, rapi_cert, hmac_key):
+  for content in (noded_cert, rapi_cert, confd_hmac_key):
     if re.search('^!EOF\.', content, re.MULTILINE):
       raise errors.OpExecError("invalid SSL certificate or HMAC key")
 
@@ -443,8 +443,8 @@ def SetupNodeDaemon(cluster_name, node, ssh_key_check):
     noded_cert += "\n"
   if not rapi_cert.endswith("\n"):
     rapi_cert += "\n"
-  if not hmac_key.endswith("\n"):
-    hmac_key += "\n"
+  if not confd_hmac_key.endswith("\n"):
+    confd_hmac_key += "\n"
 
   # set up inter-node password and certificate and restarts the node daemon
   # and then connect with ssh to set password and start ganeti-noded
@@ -461,9 +461,9 @@ def SetupNodeDaemon(cluster_name, node, ssh_key_check):
                "%s start %s" %
                (constants.NODED_CERT_FILE, noded_cert,
                 constants.RAPI_CERT_FILE, rapi_cert,
-                constants.HMAC_CLUSTER_KEY, hmac_key,
+                constants.CONFD_HMAC_KEY, confd_hmac_key,
                 constants.NODED_CERT_FILE, constants.RAPI_CERT_FILE,
-                constants.HMAC_CLUSTER_KEY,
+                constants.CONFD_HMAC_KEY,
                 constants.DAEMON_UTIL, constants.NODED))
 
   result = sshrunner.Run(node, 'root', mycommand, batch=False,
diff --git a/lib/cli.py b/lib/cli.py
index 51c239c09cdf902ca6eab74ff5190ddd39e09f3c..e4e0fe8087cf02e719f64d42d4ba7eed03c67e4d 100644
--- a/lib/cli.py
+++ b/lib/cli.py
@@ -80,7 +80,7 @@ __all__ = [
   "MC_OPT",
   "NET_OPT",
   "NEW_CLUSTER_CERT_OPT",
-  "NEW_HMAC_KEY_OPT",
+  "NEW_CONFD_HMAC_KEY_OPT",
   "NEW_RAPI_CERT_OPT",
   "NEW_SECONDARY_OPT",
   "NIC_PARAMS_OPT",
@@ -878,9 +878,11 @@ NEW_RAPI_CERT_OPT = cli_option("--new-rapi-certificate", dest="new_rapi_cert",
                                help=("Generate a new self-signed RAPI"
                                      " certificate"))
 
-NEW_HMAC_KEY_OPT = cli_option("--new-hmac-key", dest="new_hmac_key",
-                              default=False, action="store_true",
-                              help="Create a new HMAC key")
+NEW_CONFD_HMAC_KEY_OPT = cli_option("--new-confd-hmac-key",
+                                    dest="new_confd_hmac_key",
+                                    default=False, action="store_true",
+                                    help=("Create a new HMAC key for %s" %
+                                          constants.CONFD))
 
 
 def _ParseArgs(argv, commands, aliases):
diff --git a/lib/cmdlib.py b/lib/cmdlib.py
index b898469d6627efc393c104ddc1a0b3e56f97057e..32fdef9af25da0a3359ef93ae1a5967b4087bf1d 100644
--- a/lib/cmdlib.py
+++ b/lib/cmdlib.py
@@ -2280,7 +2280,7 @@ def _RedistributeAncillaryFiles(lu, additional_nodes=None):
                     constants.SSH_KNOWN_HOSTS_FILE,
                     constants.RAPI_CERT_FILE,
                     constants.RAPI_USERS_FILE,
-                    constants.HMAC_CLUSTER_KEY,
+                    constants.CONFD_HMAC_KEY,
                    ])
 
   enabled_hypervisors = lu.cfg.GetClusterInfo().enabled_hypervisors
diff --git a/lib/confd/server.py b/lib/confd/server.py
index 6c7f24dbbd5b1bfca9b4bd8d717c38a220dd6adf..e3dc58e07ecd796b21e058cb55a11a841bf529af 100644
--- a/lib/confd/server.py
+++ b/lib/confd/server.py
@@ -62,7 +62,7 @@ class ConfdProcessor(object):
 
     """
     self.disabled = True
-    self.hmac_key = utils.ReadFile(constants.HMAC_CLUSTER_KEY)
+    self.hmac_key = utils.ReadFile(constants.CONFD_HMAC_KEY)
     self.reader = None
     assert \
       not constants.CONFD_REQS.symmetric_difference(self.DISPATCH_TABLE), \
diff --git a/lib/constants.py b/lib/constants.py
index 1174d5b8743ea9eaa781bbff642cb2a1e29f1dc0..49fca781c15eaf984dfa6370b7924b7025fb0ffe 100644
--- a/lib/constants.py
+++ b/lib/constants.py
@@ -99,7 +99,7 @@ SSCONF_LOCK_FILE = LOCK_DIR + "/ganeti-ssconf.lock"
 CLUSTER_CONF_FILE = DATA_DIR + "/config.data"
 NODED_CERT_FILE = DATA_DIR + "/server.pem"
 RAPI_CERT_FILE = DATA_DIR + "/rapi.pem"
-HMAC_CLUSTER_KEY = DATA_DIR + "/hmac.key"
+CONFD_HMAC_KEY = DATA_DIR + "/hmac.key"
 WATCHER_STATEFILE = DATA_DIR + "/watcher.data"
 WATCHER_PAUSEFILE = DATA_DIR + "/watcher.pause"
 INSTANCE_UPFILE = RUN_GANETI_DIR + "/instance-status"
diff --git a/man/gnt-cluster.sgml b/man/gnt-cluster.sgml
index e7947d049ed3870f8256576b2158c2f11aaaf738..450f4048c875360c17ea921ac1ca9db46c6fc29a 100644
--- a/man/gnt-cluster.sgml
+++ b/man/gnt-cluster.sgml
@@ -711,7 +711,7 @@
         <arg>-f</arg>
         <sbr>
         <arg choice="opt">--new-cluster-certificate</arg>
-        <arg choice="opt">--new-hmac-key</arg>
+        <arg choice="opt">--new-confd-hmac-key</arg>
         <sbr>
         <arg choice="opt">--new-rapi-certificate</arg>
         <arg choice="opt">--rapi-certificate <replaceable>rapi-cert</replaceable></arg>
@@ -722,7 +722,7 @@
         Ganeti daemons in the cluster and start them again once the new
         certificates and keys are replicated. The options
         <option>--new-cluster-certificate</option> and
-        <option>--new-hmac-key</option> can be used to regenerate the
+        <option>--new-confd-hmac-key</option> can be used to regenerate the
         cluster-internal SSL certificate respective the HMAC key used by
         <citerefentry>
         <refentrytitle>ganeti-confd</refentrytitle><manvolnum>8</manvolnum>
diff --git a/qa/qa_cluster.py b/qa/qa_cluster.py
index d4efc50deb3b52713ac3412e8015648f2f4028de..5c88a04e9fe3921a4bb600e972789f3d44d076c7 100644
--- a/qa/qa_cluster.py
+++ b/qa/qa_cluster.py
@@ -152,7 +152,7 @@ def TestClusterRenewCrypto():
 
   # Conflicting options
   cmd = ["gnt-cluster", "renew-crypto", "--force",
-         "--new-cluster-certificate", "--new-hmac-key",
+         "--new-cluster-certificate", "--new-confd-hmac-key",
          "--new-rapi-certificate", "--rapi-certificate=/dev/null"]
   AssertNotEqual(StartSSH(master["primary"],
                           utils.ShellQuoteArgs(cmd)).wait(), 0)
@@ -184,7 +184,7 @@ def TestClusterRenewCrypto():
 
   # Normal case
   cmd = ["gnt-cluster", "renew-crypto", "--force",
-         "--new-cluster-certificate", "--new-hmac-key",
+         "--new-cluster-certificate", "--new-confd-hmac-key",
          "--new-rapi-certificate"]
   AssertEqual(StartSSH(master["primary"],
                        utils.ShellQuoteArgs(cmd)).wait(), 0)
diff --git a/scripts/gnt-cluster b/scripts/gnt-cluster
index 0a4cc5cc783701933145d5efc1d5f08b68091e3b..1a58f11e6b584c0c1e2cc730aa1f84ba436cbc28 100755
--- a/scripts/gnt-cluster
+++ b/scripts/gnt-cluster
@@ -495,7 +495,7 @@ def SearchTags(opts, args):
 
 
 def _RenewCrypto(new_cluster_cert, new_rapi_cert, rapi_cert_filename,
-                 new_hmac_key, force):
+                 new_confd_hmac_key, force):
   """Renews cluster certificates, keys and secrets.
 
   @type new_cluster_cert: bool
@@ -504,13 +504,14 @@ def _RenewCrypto(new_cluster_cert, new_rapi_cert, rapi_cert_filename,
   @param new_rapi_cert: Whether to generate a new RAPI certificate
   @type rapi_cert_filename: string
   @param rapi_cert_filename: Path to file containing new RAPI certificate
-  @type new_hmac_key: bool
-  @param new_hmac_key: Whether to generate a new HMAC key
+  @type new_confd_hmac_key: bool
+  @param new_confd_hmac_key: Whether to generate a new HMAC key
   @type force: bool
   @param force: Whether to ask user for confirmation
 
   """
-  assert new_cluster_cert or new_rapi_cert or rapi_cert_filename or new_hmac_key
+  assert (new_cluster_cert or new_rapi_cert or rapi_cert_filename or
+          new_confd_hmac_key)
 
   if new_rapi_cert and rapi_cert_filename:
     ToStderr("Only one of the --new-rapi-certficate and --rapi-certificate"
@@ -548,7 +549,7 @@ def _RenewCrypto(new_cluster_cert, new_rapi_cert, rapi_cert_filename,
   def _RenewCryptoInner(ctx):
     ctx.feedback_fn("Updating certificates and keys")
     bootstrap.GenerateClusterCrypto(new_cluster_cert, new_rapi_cert,
-                                    new_hmac_key,
+                                    new_confd_hmac_key,
                                     rapi_cert_pem=rapi_cert_pem)
 
     files_to_copy = []
@@ -559,8 +560,8 @@ def _RenewCrypto(new_cluster_cert, new_rapi_cert, rapi_cert_filename,
     if new_rapi_cert or rapi_cert_pem:
       files_to_copy.append(constants.RAPI_CERT_FILE)
 
-    if new_hmac_key:
-      files_to_copy.append(constants.HMAC_CLUSTER_KEY)
+    if new_confd_hmac_key:
+      files_to_copy.append(constants.CONFD_HMAC_KEY)
 
     if files_to_copy:
       for node_name in ctx.nonmaster_nodes:
@@ -584,7 +585,7 @@ def RenewCrypto(opts, args):
   return _RenewCrypto(opts.new_cluster_cert,
                       opts.new_rapi_cert,
                       opts.rapi_cert,
-                      opts.new_hmac_key,
+                      opts.new_confd_hmac_key,
                       opts.force)
 
 
@@ -790,8 +791,8 @@ commands = {
     "Alters the parameters of the cluster"),
   "renew-crypto": (
     RenewCrypto, ARGS_NONE,
-    [NEW_CLUSTER_CERT_OPT, NEW_RAPI_CERT_OPT, RAPI_CERT_OPT, NEW_HMAC_KEY_OPT,
-     FORCE_OPT],
+    [NEW_CLUSTER_CERT_OPT, NEW_RAPI_CERT_OPT, RAPI_CERT_OPT,
+     NEW_CONFD_HMAC_KEY_OPT, FORCE_OPT],
     "[opts...]",
     "Renews cluster certificates, keys and secrets"),
   }
diff --git a/tools/cfgupgrade b/tools/cfgupgrade
index 5ecc098d2fd47871de49b405817dcd4d9af6a212..fa6a8194dfc69b0121901dbba8867edbbe403b1c 100755
--- a/tools/cfgupgrade
+++ b/tools/cfgupgrade
@@ -121,7 +121,7 @@ def main():
   options.SERVER_PEM_PATH = options.data_dir + "/server.pem"
   options.KNOWN_HOSTS_PATH = options.data_dir + "/known_hosts"
   options.RAPI_CERT_FILE = options.data_dir + "/rapi.pem"
-  options.HMAC_CLUSTER_KEY = options.data_dir + "/hmac.key"
+  options.CONFD_HMAC_KEY = options.data_dir + "/hmac.key"
 
   SetupLogging()